银行卡识别与抽取（ADP）

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:23 AM UTC
• Version: 1.0.0

Overview

The skill appears to perform the advertised bank-card extraction through Laiye ADP, but its setup and bundled CLI documentation expose users to unverified installer execution and broader document-processing authority than the narrow card task requires.

Review this skill before installing. Prefer a pinned, verifiable release or inspected binary instead of curl-to-bash, PowerShell iex, or an unpinned global npm install. Only process card images you are authorized to send to Laiye ADP, check the provider's data-handling terms, and avoid giving an agent permission to use the broader ADP CLI commands unless you need them.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:64

Finding

Unverified Remote Installer Is Downloaded and Immediately Executed

Content

View full analysis

Remediation

View remediation

/scripts/adp-init.sh" ``` 4. Publish a SHA-256 checksum through a separately protected release channel and require verification before execution: ```bash echo " adp-init.sh" | sha256sum --check - ``` 5. Prefer cryptographic release signatures with documented public-key verification. 6. Instruct users to inspect the downloaded script before manually executing it. 7. Explicitly warn users not to run the installer as root or Administrator unless a documented operation strictly requires elevation. 8. Prefer a versioned package or signed release artifact installed into a user-scoped directory. 9. Ensure the same hardened instructions are applied consistently to `SKILL.md`, `README.md`, and `README-CN.md`. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:58

Finding

Unpinned Package Is Installed Globally from a Third-Party Registry

Content

View full analysis

Remediation

View remediation

``` 2. Publish the expected package version and npm integrity digest in the documentation. 3. Prefer a project-local or isolated installation over `-g` where technically possible. 4. Use a lockfile for managed deployments and verify that the resolved package and transitive dependencies match reviewed integrity values. 5. Audit package lifecycle scripts before installation. Disable them with `--ignore-scripts` where the package can operate without installation scripts. 6. Do not run npm as root or Administrator. 7. Document a controlled upgrade process that requires review before changing the pinned version. 8. Consider signed release artifacts or package provenance attestations and verify them during installation. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (20)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The curl ... | bash pattern is a classic command-chaining risk because untrusted network content is executed immediately without verification. In the context of a skill handling sensitive financial-document workflows, encouraging this pattern meaningfully raises supply-chain and endpoint-compromise risk for users installing the tool.

Content

Scanner excerpt · README-CN.md (reported line 29)May include surrounding context.

bash

# 方法 2: Shell 脚本（Linux / macOS，无 npm 环境时使用）
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

Piping remote content directly into bash is a high-risk command-chaining pattern because it combines retrieval and execution without any review boundary. In an AI-skill context, this is especially dangerous since users or agents may copy the command verbatim, leading to immediate arbitrary code execution from attacker-controlled or compromised upstream content.

Content

Scanner excerpt · README.md (reported line 30)May include surrounding context.

bash

# Method 2: Shell script (Linux / macOS, when npm is not available)
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documented command set includes broad local parsing, remote URL ingestion, Base64 input handling, async task querying, and custom app management far beyond the stated bank-card extraction use case. In a skill ecosystem, such undocumented-overreach behavior can be abused to process arbitrary documents or interact with unrelated applications, increasing data-exfiltration and capability-expansion risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Custom application creation, update, and deletion introduce administrative control planes unrelated to simple card recognition. Exposing lifecycle management inside a narrow extraction skill enables privilege expansion, configuration tampering, or use of the skill as a gateway to broader platform functionality.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The pipe-to-shell pattern (| bash) is a classic command-chaining risk because it turns remote content into immediate code execution with no opportunity for validation. In a skill intended for general users, this materially increases danger because users are encouraged to run a high-risk installation command as part of normal setup.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

bash

# 方法 2: Shell 脚本（Linux / macOS，无 npm 环境时使用）
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The README advertises a broad, general-purpose ADP document-processing CLI rather than a narrowly scoped bank-card recognition skill. This scope mismatch is dangerous because agents or users may invoke capabilities far beyond the declared purpose, including generic document parsing and processing of arbitrary files, increasing the chance of unintended data handling and privilege expansion.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README instructs users to configure cloud credentials and process local or remote documents but does not clearly disclose that document contents and supplied URLs are transmitted to an external cloud service. Because the skill targets bank-card data, the missing disclosure is especially risky: users may unknowingly send sensitive financial information and metadata off-device, creating privacy, compliance, and data-governance exposure.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documented commands expose generic parsing, custom-app lifecycle management, and account/credit operations that exceed the declared skill function of credit-card field extraction. In an agent context, this broad command surface can enable misuse or accidental invocation of unrelated operations, undermining least privilege and making the skill more capable than users expect.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The README describes a general-purpose ADP document-processing CLI with broad autonomous parsing and extraction capabilities, which materially exceeds the declared scope of a skill limited to credit-card recognition and extraction. In an agent-skill context, this mismatch expands the tool's effective authority and can mislead downstream agents or reviewers into granting broader document access and execution paths than intended.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README instructs users to execute downloaded shell and PowerShell scripts directly from the network without inspection or integrity verification. This is dangerous because a compromised repository, CDN path, account, or MITM-adjacent distribution point could result in arbitrary code execution on the user's machine during installation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Remote URL ingestion is broader than necessary for a bank-card recognition skill and can cause the system to fetch attacker-controlled or sensitive internal resources. In agent contexts, this increases SSRF-like data access, unintended third-party data transfer, and processing of arbitrary remote content outside the expected local user-provided card image workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs users to send bank card images and extract card number, issuer, validity period, and card type through a remote third-party ADP service, but it does not prominently warn that this is highly sensitive financial data subject to privacy, compliance, and data-handling obligations. In this context, the missing warning is materially important because users may unknowingly transmit payment-card data off-device to an external processor.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The README recommends installing via a remote shell script fetched directly from GitHub and piped into the shell. Even if intended as convenience, this is dangerous because any compromise of the upstream repository, delivery path, or referenced script would result in immediate arbitrary code execution on the user’s machine.

Content

Scanner excerpt · README-CN.md (reported line 29)May include surrounding context.

bash

# 方法 2: Shell 脚本（Linux / macOS，无 npm 环境时使用）
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The curl ... | bash pattern fetches executable content from a remote source and immediately hands it to the shell. For a skill README, this normalizes unsafe installation behavior and exposes users to arbitrary command execution if the fetched script is altered or replaced.

Content

Scanner excerpt · README.md (reported line 30)May include surrounding context.

bash

# Method 2: Shell script (Linux / macOS, when npm is not available)
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The skill tells users to fetch and execute a remote shell script directly from GitHub using curl ... | bash, which bypasses review, pinning, and integrity verification. If the upstream repository, network path, or referenced script changes or is compromised, users may execute attacker-controlled code immediately on their systems.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

bash

# 方法 2: Shell 脚本（Linux / macOS，无 npm 环境时使用）
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill recommends running adp config get to verify configuration without warning that configuration output may reveal credential-related details on screen, in shell history, logs, or recorded sessions. While this is not a direct secret exfiltration mechanism by itself, it increases the chance of accidental API key disclosure during setup and troubleshooting.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · license.md (reported line 10)May include surrounding context.

md

1. Licensing

1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to:
Personal learning, research, teaching, and evaluation.
Technical exchanges within academic institutions or open-source communities, non-profit projects.
Integration or demonstration in non-commercial products or services.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · license.md (reported line 14)May include surrounding context.

md

1. Licensing

1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to:
Personal learning, research, teaching, and evaluation.
Technical exchanges within academic institutions or open-source communities, non-profit projects.
Integration or demonstration in non-commercial products or services.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · license.md (reported line 22)May include surrounding context.

md

1. Licensing

1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to:
Personal learning, research, teaching, and evaluation.
Technical exchanges within academic institutions or open-source communities, non-profit projects.
Integration or demonstration in non-commercial products or services.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · license.md (reported line 32)May include surrounding context.

md

4. Disclaimer of Warranties

THE PRODUCT IS PROVIDED "AS IS", WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO: THE LICENSOR DOES NOT WARRANT THAT THE PRODUCT IS FREE FROM ERRORS, BUGS, WILL OPERATE PROPERLY, OR IS SUITABLE FOR A PARTICULAR PURPOSE; THE LICENSOR DOES NOT WARRANT THAT USE OF THE PRODUCT WILL NOT INFRINGE UPON THIRD-PARTY RIGHTS; THE LICENSOR SHALL NOT BE LIABLE TO THE LICENSEE OR ANY THIRD PARTY FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, OR PUNITIVE DAMAGES ARISING FROM THE USE OF THE PRODUCT.

5. Termination